TL;DR
['Local privilege escalation vulnerability in npm cli allows attackers to gain elevated permissions on affected systems.', 'Attackers must first execute low-privileged code on the target system.']
What happened
['A zero-day vulnerability has been identified in npm cli, allowing local users to escalate their privileges on affected installations.', 'The flaw enables an attacker who can run arbitrary low-privilege commands to gain unauthorized access to elevated permissions.', 'This issue is rated CVSS:7.8 by the Zero Day Initiative.']
Why it matters for ops
['npm cli versions are vulnerable if they do not have proper mitigations against uncontrolled search path elements.', 'Attackers may exploit this flaw to elevate their privileges on systems running affected npm cli installations.']
Mitigation
- Update npm cli to the latest version with mitigations against uncontrolled search path elements.
- Implement least privilege principles for all user accounts and processes on the system.
Action items
- Immediately update npm cli installations to mitigate CVE-2026-0775
- Review logs for suspicious activity related to low-privilege commands escalating privileges
Detection IOCs
- Unusual local privilege escalation attempts in system logs
- Unexpected execution of low-privileged code followed by elevation of permissions requests